Wireshark-dev: Re: [Wireshark-dev] Question regarding the information provided by Wireshark in
From: Lars Ruoff <Lars.Ruoff@xxxxxxxxxx>
Date: Thu, 19 Oct 2006 14:20:10 +0200

Andreina, i replied to your private mail, but i also reply to this for archiving purposes...

Andreina Toro wrote:
    Hi everyone, I have a question regarding the calculation of
    interarrival jitter and the information provided by Wireshark in the
    "RTP Stream Analysis Wndow" for each call.

I can see that Wireshark gives me in the 4th Row of the RTP Stream Analysis Wndow the Jitter for each packet of each call. In the other hand I´ve read that: "If Si is the RTP timestamp from packet i, and Ri is the time of arrival in RTP timestamp units for packet i, then for two packets i and j, D may be expressed as D(i,j)=(Rj-Ri)-(Sj-Si)=(Rj-Sj)-(Ri-Si) The interarrival jitter is calculated continuously as each data packet i is received from source SSRC_n, using this difference D for that packet and the previous packet i-1 in order of arrival (not necessarily in sequence), according to the formula J=J+(|D(i-1,i)|-J)/16
Whenever a reception report is issued, the current value of J is sampled."
What I don´t have clear is what this Jitter in the 4th Row represents in the interarrival jitter calculation?

Well, it represents just that!
The value in 4th column *is* the value of J(i) according to the above formula (ref. RFC 3550), starting with J(0):=0 and Ri:=frame.time(i) and Si:=rtp.timestamp(i) in appropriate units (for conversion between units, the clock sample rate is used - for details see the code in rtp_analysis.c).

Can I calculate the jitter J, defined to be the mean deviation, with that data? I mean, can I use the values of the jitters of each packet given in that RTP Stream Analysis in every call and calculate the difference D??

                            D_m = \frac{1}{n} \sum_{i=1}^n \left| x_i -
\overline{x} \right|

What do you call "the jitter J"?
As said, the Jitter J(i) on a packet-by-packet basis is defined as above and viewed in Wireshark RTP analysis in the 4th column. If you want to have *one* value of J for a whole communication, feel free the take the (arithmetic) mean over all J(i) (this is done and shown on the RTP streams window by stream btw.) or use some other mean/average.
I cannot tell you if one is more representative/common than another though.

best regards,
Lars Ruoff